Unable to access virtual server over port 53

Question

I currently have virtual server set up a load balance across three DNS servers. If I issue command "nslookup www.google.com [IP of VS]" from a client machine I'm getting a DNS request time out error. I've verified that the vIP is reachable from the client and it's operational on the BIG-IP. The DNS servers are reachable on the BIG-IP as well and are passing the monitor associated with the pool.

greg_labelle · Answer

Can you post the configuration for the virtual server here?

sarah_258804 · Answer

{&nbsp;
  "name": "DNS-Internal-VS",&nbsp;
  "template": "appsvcs_integration_v1.0_001",&nbsp;
  "virtualServerReferences": [&nbsp;
    {&nbsp;
      "link": ""&nbsp;
    }&nbsp;
  ],&nbsp;
  "vars": {&nbsp;
    "extensions__Field1": "",&nbsp;
    "extensions__Field2": "",&nbsp;
    "extensions__Field3": "",&nbsp;
    "feature__easyASMPolicy": "disabled",&nbsp;
    "feature__easyL4Firewall": "auto",&nbsp;
    "feature__insertXForwardedFor": "auto",&nbsp;
    "feature__redirectToHTTPS": "auto",&nbsp;
    "feature__securityEnableHSTS": "disabled",&nbsp;
    "feature__sslEasyCipher": "disabled",&nbsp;
    "feature__statsHTTP": "auto",&nbsp;
    "feature__statsTLS": "auto",&nbsp;
    "iapp__appStats": "enabled",&nbsp;
    "iapp__mode": "auto",&nbsp;
    "iapp__routeDomain": "auto",&nbsp;
    "iapp__strictUpdates": "enabled",&nbsp;
    "pool__AdvOptions": "",&nbsp;
    "pool__Description": "pooldescr",&nbsp;
    "pool__LbMethod": "round-robin",&nbsp;
    "pool__MemberDefaultPort": "53",&nbsp;
    "pool__Monitor": "/Common/dns_53",&nbsp;
    "pool__Name": "DNS-Internal-Pool",&nbsp;
    "pool__addr": "10.251.12.30",&nbsp;
    "pool__mask": "255.255.255.255",&nbsp;
    "pool__port": "53",
    "vs__AdvOptions": "",&nbsp;
    "vs__AdvProfiles": "",  &nbsp;
    "vs__ConnectionLimit": "0",&nbsp;
    "vs__Description": "vsdescr",&nbsp;
    "vs__IpProtocol": "udp", &nbsp;
    "vs__Irules": "",&nbsp;
    "vs__Name": "",&nbsp;
    "vs__OptionConnectionMirroring": "disabled",&nbsp;
    "vs__OptionSourcePort": "preserve",&nbsp;
    "vs__ProfileAccess": "",&nbsp;
    "vs__ProfileAnalytics": "",&nbsp;
    "vs__ProfileClientProtocol": "/Common/udp_gtm_dns",  &nbsp;
    "vs__ProfileClientSSL": "",&nbsp;
    "vs__ProfileClientSSLAdvOptions": "",&nbsp;
    "vs__ProfileClientSSLCert": "",&nbsp;
    "vs__ProfileClientSSLChain": "",&nbsp;
    "vs__ProfileClientSSLCipherString": "",&nbsp;
    "vs__ProfileClientSSLKey": "",&nbsp;
    "vs__ProfileCompression": "",&nbsp;
    "vs__ProfileConnectivity": "",&nbsp;
    "vs__ProfileDefaultPersist": "",&nbsp;
    "vs__ProfileFallbackPersist": "",&nbsp;
    "vs__ProfileHTTP": "",&nbsp;
    "vs__ProfileOneConnect": "",&nbsp;
    "vs__ProfilePerRequest": "",&nbsp;
    "vs__ProfileRequestLogging": "",&nbsp;
    "vs__ProfileSecurityDoS": "",&nbsp;
    "vs__ProfileSecurityIPBlacklist": "none",&nbsp;
    "vs__ProfileSecurityLogProfiles": "",&nbsp;
    "vs__ProfileServerProtocol": "/Common/udp_gtm_dns",&nbsp;
    "vs__ProfileServerSSL": "",&nbsp;
    "vs__SNATConfig": "automap",&nbsp;
    "vs__SourceAddress": "0.0.0.0/0"&nbsp;
  },&nbsp;
  "tables": {&nbsp;
    "feature__easyL4FirewallBlacklist": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          ""&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "feature__easyL4FirewallSourceList": {&nbsp;
      "columns": [&nbsp;
        "CIDRRange"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [ &nbsp;
          "0.0.0.0/0"&nbsp;
        ]&nbsp;
      ]&nbsp;
    },&nbsp;
    "pool__Members": {&nbsp;
      "columns": [&nbsp;
        "IPAddress",&nbsp;
        "Port",&nbsp;
        "ConnectionLimit",&nbsp;
        "Ratio",&nbsp;
        "State"&nbsp;
      ],&nbsp;
      "rows": [&nbsp;
        [&nbsp;
          "10.251.116.150",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.151",&nbsp;
          "53",&nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [&nbsp;
          "10.251.116.152", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1",&nbsp;
          "enabled"&nbsp;
        ],&nbsp;
        [ &nbsp;
          "10.251.116.153", &nbsp;
          "53", &nbsp;
          "0",&nbsp;
          "1", &nbsp;
          "enabled" &nbsp;
        ]&nbsp;
      ]&nbsp;
    }&nbsp;
  },&nbsp;
  "generation": 0,&nbsp;
  "lastUpdateMicros": 0, &nbsp;
  "selfLink": ""&nbsp;
}  &nbsp;

sarah_258804 · Answer

Configuration of application profile below.

greg_labelle_31 · Answer

I notice that your virtual server is setup for UDP.  When the response for a DNS query contains more records than can fit in a single UDP packet, it will leverage TCP instead to send the query.  Try resolving a simple query that has only one record to test the theory. If this is the case, you'll need to setup a second virtual server at the same address and port using the TCP protocol as well to support both paradigms.

sarah_258804 · Answer

I tried that and no dice. I have a ticket open for this issue and it was pointed out that I didn't have a "DNS Profile" assigned to this virtual server. I added the basic DNS profile and still no resolving ip addresses with the virtual server IP.

Forum Discussion

Unable to access virtual server over port 53

5 Replies

Recent Discussions

What are the different phases in DevOps?

Create a CSR and Key using the BigIP LTM GUI when renewing a certificate

F5 Rseries HA

Error when running bigip_command Playbook against LTM : Syntax Error: unexpected argument /bin/sh\n

Can iRule be used to perform exception of IPI category based on Geolocation

Related Content

Restrict access to virtual server during specified time

Unable to Create UCS files

Virtual Server Cannot Access External Pool Members

Why my virtual server can't be accessed

Unable to remove older software image from F5 guest